A critical privilege escalation vulnerability in the Advanced Custom Fields: Extended plugin allows unauthenticated attackers to gain administrative control over the WordPress site.

This flaw stems from improper privilege management (CWE-269) within the plugin front-end user forms, where incomplete role validation permits unauthenticated visitors to register accounts with elevated capabilities, subsequently leading to full administrative access.

Successful exploitation of this vulnerability results in a total compromise of the affected WordPress instance. An attacker gaining administrative access can exfiltrate sensitive data, modify site content, install malicious backdoors, or perform further attacks against the underlying hosting infrastructure. With a CVSS score of 8.1, the high severity reflects the extreme risk posed to the confidentiality, integrity, and availability of the web application.

Immediate Action: Update the Advanced Custom Fields: Extended plugin to version 0.9.2.7 or later immediately to resolve the flawed registration logic.

Proactive Monitoring: Review WordPress user registration logs for suspicious account creations, particularly those occurring outside of standard business hours or from unexpected IP addresses.

Compensating Controls: If an immediate update is not feasible, disable public registration on the WordPress site and implement a Web Application Firewall (WAF) rule to block unauthorized traffic targeting registration endpoints.

Public Exploit Available: Unknown

The risk of unauthorized administrative access necessitates immediate attention. Administrators must verify their plugin version and apply the update to 0.9.2.7 without delay. Failure to patch this flaw leaves the entire site architecture vulnerable to total takeover, emphasizing the urgency of this maintenance task.